The vulnerability CVE-2026-28025 in ThemeREX Stargaze (<= 1.5) arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This allows an attacker to include local files on the server, which can lead to execution of arbitrary code or disclosure of sensitive information. The CVSS 3.1 score is 8.1, with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files on the server hosting the vulnerable ThemeREX Stargaze application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable application to untrusted networks and consider applying temporary mitigations such as restricting file inclusion paths or disabling vulnerable functionality if possible.